• Ard Biesheuvel's avatar
    efivarfs: Move efivarfs list into superblock s_fs_info · cdb46a8a
    Ard Biesheuvel authored
    syzbot reports issues with concurrent fsopen()/fsconfig() invocations on
    efivarfs, which are the result of the fact that the efivarfs list (which
    caches the names and GUIDs of existing EFI variables) is a global
    structure. In normal use, these issues are unlikely to trigger, even in
    the presence of multiple mounts of efivarfs, but the execution pattern
    used by the syzkaller reproducer may result in multiple instances of the
    superblock that share the global efivarfs list, and this causes list
    corruption when the list is reinitialized by one user while another is
    traversing it.
    
    So let's move the list head into the superblock s_fs_info field, so that
    it will never be shared between distinct instances of the superblock. In
    the common case, there will still be a single instance of this list, but
    in the artificial syzkaller case, no list corruption can occur any
    longer.
    
    Reported-by: syzbot+1902c359bfcaf39c46f2@syzkaller.appspotmail.com
    Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
    cdb46a8a
inode.c 4.31 KB